AutoHotkey Data Breach
The 2015 AutoHotkey data breach occurred when unauthorized threat actors breached the community forum infrastructure of AutoHotkey (autohotkey.com), the renowned open-source automation scripting language for Windows.
Exposed Data Types
4- Email addresses
- Passwords
- Usernames
- IP addresses
About This Breach
The incident compromised forum member profile information, registered email addresses, connection IP addresses, and salted password hashes.
What information was affected in the AutoHotkey incident?
The compromised forum export contains member identity records from the project's developer community. The leak impacted 44,417 unique user accounts, exposing the following data categories:
- Account Identifiers: Community usernames.
- Contact Credentials: Canonical email addresses.
- Network Data: Registration and login IP addresses.
- Authentication Credentials: Invision Power Board (IPBoard) cryptographic password hashes alongside respective salt values.
How many accounts were affected?
Canonical extraction and deduplication of the database dump confirmed 44,417 unique canonical email addresses across 88,871 raw forum member rows.
Technical analysis and security risks
The exposure stems from a backend SQL database dump of the forum member directory. Although password records are protected by salts and hashes, common passwords remain vulnerable to offline dictionary and rainbow table cracking. Furthermore, the developer-centric nature of the community makes affected email addresses attractive targets for spear-phishing and social engineering attacks.
Recommended actions for affected users
Members of the AutoHotkey community should:
- Ensure that any password utilized on the AutoHotkey forum during or prior to 2015 is discontinued across all online platforms.
- Remain vigilant regarding targeted phishing attempts referencing scripting libraries, software updates, or IT tooling.
- Enforce two-factor authentication (2FA / MFA) on personal email and code hosting platforms.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
